Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why firewalls won’t matter in a few years

etherealmind.com

Post reply on HN
Print view View original

81–90 of 139 posts

Re: Why firewalls won’t matter in a few years

#81

Post by XorNot »

belorn wrote: post #57
tptacek wrote: post #40

Earlier quoted context omitted.

If this observation is meaningful, shouldn't it also be the case that firewall deployments aren't meaningful to enterprise security? Because: that seems intuitively not to be the case. To wit: on an annual site-wide pentest of any major enterprise network (this is a project every security firm does for a couple clients a year), the moment the pentester gets "behind the firewall" (ie: code execution on any application…

There are still a lot of software which uses network masks for authentication purposes. When something like that can be become key components inside an enterprise, you can't really talk about enterprise security when inside the walls of the firewall. There simply isn't any.

It's because the entire experience of SSL sucks. Want to deal with some random, annoying and recurring issues? Deploy SSL on your app and then try and figure out which arcane cert issue is causing verification to fail.

Re: Why firewalls won’t matter in a few years

#82

Post by josai »

TheLoneWolfling wrote: post #75
jimktrains2 wrote: post #74

Earlier quoted context omitted.

What is being sent to the server then? And by plain-text, I mean the server receives information that could then be used to authenticate later. For instance, if you send the sha of a password, and then store the sha of the sha, you're still sending the password in plaintext, it's just that it's not the password the user entered.

...Which is why I said "over a secure connection". This method is no less secure than the standard "client sends server password over HTTPS" scheme.

> ...Which is why I said "over a secure connection".

... and how do you set up a secure connection without a pre-existing password?

Your solution has a chicken-and-egg problem.

Re: Why firewalls won’t matter in a few years

#83

Post by joshrivers »

sliverstorm wrote: post #61
joshrivers wrote: post #49

Earlier quoted context omitted.

'Game over': I think this is exactly the problem. In all the organizations I've been in, firewalls have been an excuse for negligence. 'We don't need to think about security because we are behind the firewall.' Right now the compliance world is addicted to firewalls, to the detriment to reasonable appsec. In my fantasy world, I'd like the auditors to be telling companies 'in 5 years, you won't be allowed to firewall…

You're probably right that firewalls allow negligence elsewhere. But if they can't secure their one firewall, what makes you think they can secure their complex network of a plethora of interdependent services running across many subdomains on a whole roomfull of machines? "Simple" is a key step to effective security, and I think the reason we've latched on to firewalls is they are often the simplest, most contained,…

I think in many cases you will be right and 'they' won't be able to secure it. This will force them to contact out those applications to someone who can. Plenty of SaaS providers able to secure a network. Just because my incompetent I.T. Guy can't properly harden a mail server doesn't mean we can't hire Rackspace or Microsoft or someone else who can. Let's incentivize competence, not hide incompetence.

Re: Why firewalls won’t matter in a few years

#84

Post by ChuckMcM »

tptacek wrote: post #40
nickpsecurity wrote: post #10

Firewalls are just some stupid crap industry made up and went with. We've known since the Orange Book days that security had to be done holistically involving every endpoint and network. Their standard for security was a strong TCB on endpoint with trusted path (see EROS or Dresden's Nitpicker); a network card with onboard security kernel, firewall, and crypto (see GNTP + GEMSOS); connections between networks through…

If this observation is meaningful, shouldn't it also be the case that firewall deployments aren't meaningful to enterprise security? Because: that seems intuitively not to be the case. To wit: on an annual site-wide pentest of any major enterprise network (this is a project every security firm does for a couple clients a year), the moment the pentester gets "behind the firewall" (ie: code execution on any application…

   > My argument would be: whether firewalls are "stupid crap" or not, they certainly do seem to matter right now.
Which would be the hard nut of the matter. Just as security guards at a checkpoint to a military base provide some value in at least awareness of a threat. But if we take the article at face value then we have to believe that the role of the firewall will become greatly diminished to something more sentry like rather than something that aspires to be a portcullis. And while the ability of the gateway infrastructure to prevent an attack from occurring arrives it may be able to raise the cost of mounting an attack by the network equivalent of ASLR on the stack by intentionally re-routing some parts of the network connect to avoid things like bogus source routing, or confusing CBC ciphers in private protocols.

Re: Why firewalls won’t matter in a few years

#85

Post by JoachimS »

Spooky23 wrote: post #38
danellis wrote: post #11

"You can’t use firewalls to secure East/West data flows in the network." What does that mean?

Think of a blade chassis in a datacenter. If blade1 needs to talk to blade2, running it through a firewall means that the communications needs to flow out of the blade back to the datacenter network (ie. flowing north to the top of the rack switch). That adds latency and requires more network and firewall capacity, as all traffic needs to leave the chassis. If there is no firewall requirement, traffic flows east/west…

Because left/right and up/down a rack are so complicated terms we need to use a compass... ;-)

Re: Why firewalls won’t matter in a few years

#86

Post by EtherealMind »

bnewbold wrote: post #51

I'm not sure I agree with the argument that faster line rates creating a speed limit for firewalls. It seems like firewall hardware could parallelize internally at layer 3, sharding by source/destination IP or port, so all packets from a single flow will go through the same processing core, no? This would add a finite latency, but I don't think it would impact throughput. Am I missing something?

There are some non-obvious issues:

1. Why not firewall in the operating system and distribute/scale the load evenly ? Centralising the firewall was done when OS provisioning was bad, now we have Puppet/Chef/Ansible, firewalls operations is simple enough.

2. Simple firewalling is effectively worthless when 99% of all traffic is HTTP/S and SSH. To add value you perform flow analysis combined with deep packet inspection to build a meta-data data to pass through a heuristics/pattern analysis to perform threat detection.

3. Passing through any device creates latency in the order of milliseconds, which is not acceptable in east/west traffic loads. Parallelisation, caching, flow cut-through will all incur a latency penalty.

HTH

greg

Re: Why firewalls won’t matter in a few years

#87

Post by EtherealMind »

danellis wrote: post #11

"You can’t use firewalls to secure East/West data flows in the network." What does that mean?

Here is my explanation of the East/West & North/South int terms of Data Centre network architecture

http://etherealmind.com/layer-2-multipath-east-west-bandwidt...

Re: Why firewalls won’t matter in a few years

#88

Post by EtherealMind »

madsushi wrote: post #59

"NSX is getting strong traction" With fewer than 500 paying customers, I don't see how you can describe NSX as having "strong traction".

Two things:

1. the number is more than 800. 2. NSX is being deployed primarily as a security tool for micro-segmentation. It is displacing firewalls in the data centre is substantly way. 3. Change in the data centre is slow. Infrastructure is commonly built on 10-15 year cycles so actual purchases are a lagging indicator.

Re: Why firewalls won’t matter in a few years

#89

Post by cm2187 »

One of the bullet points says "DNSSEC is dead". But what is the plan then? it sounds odd to rely on a completely insecure, unencrypted service for DNS (plus all the new ways in which a secure DNS service could be used, to distribute public keys for instance).
Post reply on HN